CVE-2026-119497: wpWax Directorist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.6...

CVE-2026-123368: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an...

CVE-2026-125255: FFmpeg: FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger…

FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ffmjpegdecodesof to pass a stale rawimagebuffer pointer to...

CVE-2026-119759: trailbaseio trailbase: TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated…

TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers can reference another...

CVE-2026-124850: flowintel: A SQL injection vulnerability exists in a database migration script in flowintel

A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious...

CVE-2026-118798: CompuGroup Medical Wingesfar: Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and…

Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise...

CVE-2026-121685: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials

FrodoBots EarthRover Mini+ firmware version 6.2.46.2.50.614.0 contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These...

CVE-2026-125243: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in…

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ffjpeglsdecodepicture in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-LS image with the ILV byte set to 1, causin...

CVE-2026-123809: dynatrace-oss dynatrace-mcp: Dynatrace MCP Server is an MCP server for Dynatrace Observability

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the createworkflowfornotification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutralizing Jinja2 expressions. A caller can place template...

CVE-2026-121601: Red Hat: A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad)

A flaw was found in GStreamer's MXF demuxer plugin gst-plugins-bad. When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A loc...

CVE-2026-125241: FFmpeg: FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to…

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write out of bounds because checkpixelptr checks only one bound with negative-stride frames. Attackers can supply a crafted FLIC file whose RLE and delta chunks write pixel data...

CVE-2026-125175: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsvdecodeblock in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses...

CVE-2026-123364: OctoPrint: OctoPrint provides a web interface for controlling consumer 3D printers

OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in...

CVE-2026-123371: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project and includes part of the target line when that external fil...

CVE-2026-90587: zephyrproject zephyr: usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises…

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

CVE-2026-125217: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in…

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roqdpcmencodeframe in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized uninitialized...

CVE-2026-124077: Apache Software Foundation Apache Commons Codec: The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could...

CVE-2026-118196: Apache Software Foundation Apache Allura: OAuth 1 rebinding vulnerability in Apache Allura

OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue...

CVE-2026-125230: FFmpeg: FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcm_rechunk bitstream filter that allows…

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcmrechunk bitstream filter that allows attackers to trigger division by zero via a crafted channel count. Attackers can supply a file declaring a huge channel count that is remuxed into MXF, GXF or DAUD, overflowing samplesiz...

CVE-2026-121759: Unknown Fusion Page Builder: The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the…

The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash is disabled...

CVE-2026-94249: TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk: Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows…

Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse. This issue affects Liderahenk: before 2.0.3...

CVE-2026-124623: n/a PipraPay: A security flaw has been discovered in PipraPay 3.0.0

A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is...

CVE-2026-124576: n/a BeikeShop: A security flaw has been discovered in BeikeShop up to 2.0.0.31

A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument ordernumber results in enforcement of behavioral...

CVE-2026-124557: OtterMind Chat2DB: A vulnerability was detected in OtterMind Chat2DB up to 5.3.8

A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may b...

CVE-2026-112172: CompuGroup Medical: CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session…

CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases...

CVE-2026-119078: Apache Software Foundation Apache Commons Codec: Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously…

Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again without supplying more input returns th...

CVE-2026-124834: n/a iomad: A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4

A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function storetemporarypassword of the file public/local/iomad/classes/companyuser.php of the component Password Field Handler. Such manipulation leads to information disclosure. The...

CVE-2026-124561: D-Link DIR-878: A vulnerability was determined in D-Link DIR-878 1.20B05

A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been...

CVE-2026-124033: AWS aws-parallelcluster: The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a…

The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the...

CVE-2026-112317: Red Hat: krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key…

krb5ktkdbgetentry in lib/kdb/keytab.c in MIT Kerberos 5 aka krb5 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service memory leak in the KDC or kadmind via requests that repeatedly trigger key decryptio...

CVE-2026-116337: qt Qt Framework: Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt…

Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module...

CVE-2026-123129: Unknown Event Tickets Manager for WooCommerce: The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to…

The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next eve...

CVE-2026-119613: ash-project ash_ai: Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an…

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail. AshAi.ToToolError gained an implementation for...

CVE-2026-124585: Chengdu Feiyuxing Technology: A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function addexpmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. T...

CVE-2026-124563: D-Link DIR-878: A security flaw has been discovered in D-Link DIR-878 1.20B05

A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launched remotely. The exploit has been...

CVE-2026-124570: SourceCodester Online Leave Management System: A vulnerability was detected in SourceCodester Online Leave Management System 1.0

A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site...

CVE-2026-120386: Effekseer: Effekseer improperly validates "effect" files

Effekseer improperly validates "effect" files. When a crafted effect file is loaded to the affected runtime, the host process may be forced to crash...

CVE-2026-124569: fushengqian fuintCatering: A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133

A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in improper access controls. It is possible ...

CVE-2026-124577: Intelbras SG 2404 PoE L2+: A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72

A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCUSHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit...

CVE-2026-61812: owasp-modsecurity ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser ...

CVE-2026-124509: floci-io Floci: A vulnerability was identified in floci-io Floci up to 2.1.0

A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads t...

CVE-2026-124558: DataLinkDC Dinky: A vulnerability has been found in DataLinkDC Dinky up to 1.2.5

A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch...

CVE-2026-125200: FFmpeg: FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265_encode_frame() never…

FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/libx265.c because libx265encodeframe never frees the rpu.payload allocated by ffdovirpugenerate. Attackers can supply crafted Dolby Vision HEVC or AV1 files that leak one RPU allocation per encoded frame during libx265...

CVE-2026-125208: FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() in…

FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2bufferswframetobuf in libavcodec/v4l2buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause unsigned wraparound in...

CVE-2026-125190: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in decodemvc2 in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying proce...

CVE-2026-118461: CompuGroup Medical: The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring…

The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials...

CVE-2026-125171: FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because…

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7decodeinit does not validate lastframelen against MPCFRAMESIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to rea...

CVE-2026-90585: zephyrproject zephyr: The Renesas RA SCI UART driver's receive-error ISR, uart_ra_sci_eri_isr() in drivers/serial/uart_renesas_ra_sci.c,…

The Renesas RA SCI UART driver's receive-error ISR, uartrascieriisr in drivers/serial/uartrenesasrasci.c, acknowledged the error condition only when a Zephyr interrupt-driven callback had already been registered. With CONFIGUARTINTERRUPTDRIVEN=y and CONFIGUARTASYNCAPI=n, if data-usercb is NULL th...

CVE-2026-123088: Unknown UniPAY Payment Gateway For WooCommerce: The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before…

The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate...

CVE-2026-113963: Apple: An authorization issue was addressed with improved state management

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data...